Node-RED exposes an extensive API at runtime. While most of this is not available within your flows, much of it is available to custom nodes.
Unfortunately, documentation for the API lags behind development. This page documents some of the key things I’ve learned about the API, what it does and how it works.

There are already too many people putting up insecure services over the Internet. Please don’t add to this problem.
This article explains a simple way to get some level of connectivity to Node-RED over the Internet without security issues.
It also explains some of the wider issues and where to go for more details.

The ACE editor is used in the function node to help you create well-formed JavaScript. However, there are now a number of different versions of JavaScript and it is sometimes helpful to use slightly different styles of coding to the defaults.